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IN THE CLAIMS 

Please amend the claims as follows: 

1 . (Previously presented) A method for filtering out exploits passing through a 
device, comprising: 

receiving an object to be inspected directed to the device; 
determining a first hash value associated with the object to be inspected; 
determining a second set of hash values associated with objects that have 
previously been scanned; 

if the first hash value matches at least one of the hash values in the second set, 

determining a third hash value associated with the object to be inspected; 
determining a fourth set of hash values associated with the objects that have 
previously been scanned; and 

if the third hash value matches at least one of the hash values in the fourth set, 
immediately processing the object to be inspected. 

2. (Canceled) 

3. (Canceled) 

4. (Previously presented) The method of Claim 1, wherein the first hash value 
includes a rough outline hash value (ROHV). 

5. (Previously presented) The method of Claim 4, wherein the third hash value 
includes a sophisticated signature hash value (SSHV) and wherein the ROHV requires less time 
to compute than the SSHV. 

6. (Previously presented) The method of Claim 1 , wherein immediately processing 
the object further comprises forwarding the object to be inspected to an output component 
without scanning the object to be inspected. 
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7. (Canceled) 

8. (Previously presented) The method of Claim 6, wherein immediately processing 
the object to be inspected further comprises forwarding the object to be inspected to a 
destination. 

9. (Previously presented) The method of Claim 1, further comprising if the first hash 
value does not match any of the hash values in the second set, 

scanning the object to be inspected for an exploit; and 

updating the second set of hash values to include the first hash value. 

10. (Previously presented) The method of Claim 1, further comprising if the third 
hash value does not match any of the hash values in the fourth set, 

scanning the object to be inspected for an exploit; and 

updating the fourth set of hash values to include the third hash value. 

11-17. (Canceled) 

17. (Currently amended) A system embodied on a computer storage medium encoded 
with a data-structure for protecting a device against an exploit, comprising: 

a message tracker that is configured to determine whether an object has been previously 
scanned using a two-phase hash value technique , the two-phase hash value technique 
comprising: 

determining a first hash value associated with the object; 

determining a second set of hash values associated with objects that have 
previously been scanned; 

if the first hash value does not match at least one of the hash values in the second 
set, determining that the object has not been previously scanned 

if the first hash value matches at least one of the hash values in the second set. 



determining a third hash value associated with the object; 
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determining a fourth set of hash values associated with the objects that 
have previously been scanned; 

if the third hash value does not match at least one of the hash values in the 
fourth set, determining that the object has not been previously scanned ; and 

a scanner component that is coupled to the message tracker and that is configured to 
receive an unscanned object and to determine whether the unscanned object includes an exploit. 

18-20. (Canceled) 

2 1 . (Currently amended) The system of Claim [[19]] 17, wherein the first hash value 
further comprises a ROHV. 

22-23. (Canceled) 

24. (Currently amended) The system of Claim [[22]] 17, wherein the third hash value 
further comprises a SSHV. 

25. (Currently amended) The system of Claim [[22]] 17, wherein the two-phase hash 
value technique further comprises: 

if the third hash value approximately matches at least one of the hash values in the 
fourth set, determining that the object has been previously scanned. 

26-29. (Canceled) 

30. (Previously presented): The method of Claim 1, wherein: 
the first hash value and third hash value are determined by the device; and 
the second set of hash values and the fourth set of hash values are determined by the 
device based on previous scanning by the device. 
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3 1 . (Previously presented): The method of claim 1 , wherein the method is performed 
by a firewall. 

32. (Previously presented): The method of claim I, wherein the method is performed 
by a router. 

33. (Previously presented): The method of claim 1, further comprising: 
determining whether the object to be inspected is compressed; and 

if the object is compressed, decompressing the object to be inspected. 

34. (Previously presented): The system of claim 17, wherein the system includes a 
firewall. 

35. (Previously presented): The system of claim 17, wherein the system includes a 

router. 

36. (Previously presented): A method comprising: 
receiving an object; 

matching a rough outline hash value (ROHV) of the object to ROHVs of known objects; 

if a match is found between the ROHV of the object to any of the ROHVs of the known 
objects, matching a sophisticated signature hash value (SSHV) of the objects to SSHVs of the 
known objects; 

if a match is found between the SSHV of the object to any of the SSHVs of the known 
objects, processing the object as a malicious object; 

if a match is not found between either the ROHV of the object to any of the ROHVs of 
the known objects or the SSHV of the object to any of the SSHVs of the known objects, 
scanning the object; and 

if the scanning the object determines that the object is malicious, processing the object as 
a malicious object and updating the ROHVs of known objects and the SSHVs of the known 
objects. 
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37. (Previously presented): The method of claim 1, wherein the determining the first 
hash value includes determining a rough outline hash value (ROHV) based on a hash value of a 
first portion of the object. 

38. (Previously presented): The method of claim 37, wherein determining the third 
hash value includes determining a sophisticated signature hash value (SSHV) based on a 
Message Digest -5, a Secure Hash Algorithm, or a Secure Hash Standard, and wherein the 
ROHV requires less time to compute than the SSHV. 

39-40. (Canceled) 

41. (Currently amended): The system of Claim [[19]] 17, wherein the first hash value 
further comprises a ROHV determined based on a hash value of a first portion of the object. 

42. (Currently amended): The system of Claim [[22]] 17, wherein the third hash 
value further comprises a SSHV determined based on a Message Digest -5, a Secure Hash 
Algorithm, or a Secure Hash Standard. 

43. (Previously presented): The method of claim 36, wherein: 

the ROHV is determined based on a hash value of a first portion of the object; and 
the SSHV is determined based on a Message Digest -5, a Secure Hash Algorithm, or a 
Secure Hash Standard. 



